21-029 (June 29, 2021)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DNS Server
1010986* - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)


Directory Server LDAP
1011008 - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)


Oracle E-Business Suite Web Interface
1010999 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)


Web Application PHP Based
1011013 - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


Web Client Common
1010711* - Google Chrome Buffer Overflow Vulnerability (CVE-2019-5782)
1011007 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-695)
1011006 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-697)
1011005 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-699)
1011004 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-701)
1011002 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-703)
1011001 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-704)
1011000 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-705)
1011003 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-21-702)
1011011 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-696)
1011010 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-698)
1011009 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-700)


Web Server Apache
1010997 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)


Web Server Common
1010980* - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
1010985* - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)


Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
1011015 - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability


Zoho ManageEngine
1011012 - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability


Integrity Monitoring Rules:

1010843 - Linux/Unix - Boot files modified (ATT&CK T1542)
1010845 - Linux/Unix - Default firewall rules modified (ATT&CK T1562.004)
1010846 - Linux/Unix - Disk configuration files modified (ATT&CK T1561.002)
1010847 - Linux/Unix - SSL configuration files modified (ATT&CK T1587.003)
1010793 - Linux/Unix - Shared object files modified
1010856 - Linux/Unix - Static boot loader files modified (ATT&CK T1542)
1010848 - Linux/Unix - User access control files modified (ATT&CK T1068)
1010844 - Linux/Unix - modeprobe configuration files modified (ATT&CK T1547.006)


Log Inspection Rules:

1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001)